spywareremovalguides.com » virus

Wireshark Antivirus Removal

virus removal man — Wed, 18 Aug 2010 07:39:23 +0000

Wireshark Antivirus is one of the more dangerous fake anti-malware programs out there as it uses the name of a reputed software company to trick users. However, Wireshark has denied any affiliation with this rogue application. As any other fake anti-malware program would do, Wireshark Antivirus tries to trick users into purchasing a software license. This malware application installs itself on user systems thanks to dangerous Trojan known as Trojan.Zlob that gets downloaded from malicious websites on the Internet. Once installed, Wireshark Antivirus proceeds to perform endless fake antivirus scans on the system, returning false results that claim that the system is infected with a series of dangerous viruses. The malware also generates fake warning pop-ups from the Windows Taskbar, which helps with the illusion that this is legitimate software. Finally Wireshark Antivirus asks the user to purchase the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is not sufficient to remove the detected ‘threats’. It is important to always remember that Wireshark Antivirus is a fake application that cannot scan or clean your computer under any circumstances.

If you should stumble upon an installation of this dangerous malware application on your computer, you should immediately take action to remove Wireshark Antivirus. In order to delete Wireshark Antivirus, you need to stop its processes, unregister its DLL files, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step you need to take for Wireshark Antivirus removal is to stop the following processes from executing:

Wireshark Antivirus.exe
alggui.exe
svchost.exe
dbsinit.exe
ccsmn.exe
ccsrr.exe
wpp.exe

Next, it is necessary to unregister the following DLL files:

adc_w32.dll
adc32.dll

The next step in Wireshark Antivirus removal is the deletion of the following files and folders:

Windows XP:

C:\Program Files\Wireshark Antivirus\Wireshark Antivirus.exe
c:\Program Files\adc_w32.dll
c:\Program Files\alggui.exe
c:\Program Files\extra1.dat
c:\Program Files\extra2.dat
c:\Program Files\nuar.old
c:\Program Files\skynet.dat
c:\Program Files\svchost.exe
c:\Program Files\wp3.dat
c:\Program Files\wp4.dat
c:\Program Files\scdata
c:\Program Files\scdata\dbsinit.exe
c:\Program Files\scdata\wispex.html
c:\Program Files\scdata\images
c:\Program Files\scdata\images\i1.gif
c:\Program Files\scdata\images\i2.gif
c:\Program Files\scdata\images\i3.gif
c:\Program Files\scdata\images\j1.gif
c:\Program Files\scdata\images\j2.gif
c:\Program Files\scdata\images\j3.gif
c:\Program Files\scdata\images\jj1.gif
c:\Program Files\scdata\images\jj2.gif
c:\Program Files\scdata\images\jj3.gif
c:\Program Files\scdata\images\l1.gif
c:\Program Files\scdata\images\l2.gif
c:\Program Files\scdata\images\l3.gif
c:\Program Files\scdata\images\pix.gif
c:\Program Files\scdata\images\t1.gif
c:\Program Files\scdata\images\t2.gif
c:\Program Files\scdata\images\Thumbs.db
c:\Program Files\scdata\images\up1.gif
c:\Program Files\scdata\images\up2.gif
c:\Program Files\scdata\images\w1.gif
c:\Program Files\scdata\images\w11.gif
c:\Program Files\scdata\images\w2.gif
c:\Program Files\scdata\images\w3.jpg
c:\Program Files\scdata\images\word.doc
c:\Program Files\scdata\images\wt1.gif
c:\Program Files\scdata\images\wt2.gif
c:\Program Files\scdata\images\wt3.gif
c:\Program Files\Sysinternals Antivirus
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.acf
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.ltd
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.lti
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.acb
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.aci
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.mt
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsrr.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\lleod150
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmharun.log
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmrun.log
%UserProfile%\Start Menu\Programs\Wireshark Antivirus
%UserProfile%\Start Menu\Programs\Wireshark Antivirus\Wireshark Antivirus.lnk

Windows Vista/ Windows 7:

C:\Program Files\Wireshark Antivirus\Wireshark Antivirus.exe
c:\Program Files\adc_w32.dll
c:\Program Files\alggui.exe
c:\Program Files\extra1.dat
c:\Program Files\extra2.dat
c:\Program Files\nuar.old
c:\Program Files\skynet.dat
c:\Program Files\svchost.exe
c:\Program Files\wp3.dat
c:\Program Files\wp4.dat
c:\Program Files\scdata
c:\Program Files\scdata\dbsinit.exe
c:\Program Files\scdata\wispex.html
c:\Program Files\scdata\images
c:\Program Files\scdata\images\i1.gif
c:\Program Files\scdata\images\i2.gif
c:\Program Files\scdata\images\i3.gif
c:\Program Files\scdata\images\j1.gif
c:\Program Files\scdata\images\j2.gif
c:\Program Files\scdata\images\j3.gif
c:\Program Files\scdata\images\jj1.gif
c:\Program Files\scdata\images\jj2.gif
c:\Program Files\scdata\images\jj3.gif
c:\Program Files\scdata\images\l1.gif
c:\Program Files\scdata\images\l2.gif
c:\Program Files\scdata\images\l3.gif
c:\Program Files\scdata\images\pix.gif
c:\Program Files\scdata\images\t1.gif
c:\Program Files\scdata\images\t2.gif
c:\Program Files\scdata\images\Thumbs.db
c:\Program Files\scdata\images\up1.gif
c:\Program Files\scdata\images\up2.gif
c:\Program Files\scdata\images\w1.gif
c:\Program Files\scdata\images\w11.gif
c:\Program Files\scdata\images\w2.gif
c:\Program Files\scdata\images\w3.jpg
c:\Program Files\scdata\images\word.doc
c:\Program Files\scdata\images\wt1.gif
c:\Program Files\scdata\images\wt2.gif
c:\Program Files\scdata\images\wt3.gif
c:\Program Files\Sysinternals Antivirus
%UserProfile%\AppData\Microsoft\Internet Explorer\ccsmn.exe
%UserProfile%\AppData \Microsoft\Internet Explorer\ccsmn151.acf
%UserProfile%\AppData\Microsoft\Internet Explorer\ccsmn151.ltd
%UserProfile%\AppData\Microsoft\Internet Explorer\ccsmn151.lti
%UserProfile%\AppData\Microsoft\Internet Explorer\ccsmn151_0.acb
%UserProfile%\AppData\Microsoft\Internet Explorer\ccsmn151_0.aci
%UserProfile%\AppData\Microsoft\Internet Explorer\ccsmn151_0.mt
%UserProfile%\AppData Microsoft\Internet Explorer\ccsrr.exe
%UserProfile%\AppData\Microsoft\Internet Explorer\lleod150
%UserProfile%\AppData\Microsoft\Internet Explorer\wmharun.log
%UserProfile%\AppData\Microsoft\Internet Explorer\wmrun.log
%UserProfile%\Start Menu\Programs\Wireshark Antivirus
%UserProfile%\Start Menu\Programs\Wireshark Antivirus\Wireshark Antivirus.lnk

Once the above steps have been completed, you no longer have Wireshark Antivirus files on your hard disk.

Registry Removal Procedures

File deletion alone is not sufficient to ensure that you completely remove Wireshark Antivirus. In order to ensure complete Wireshark Antivirus removal, you should remove the following settings and keys from the Windows Registry:

HKEY_CURRENT_USERSoftwareWireshark Antivirus
HKEY_CLASSES_ROOTCLSID{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesAdbUpd
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “novavapp”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “novavappr

Now it is safe to say that your computer is completely devoid of anything to do with Wireshark Antivirus. However, in order to make sure that no other malicious or malware related registry keys remain in the system it is strongly recommended to scan the entire PC using antivirus software such as Spyware Doctor with Antivirus.

Conclusion

Manual Wireshark Antivirus removal is not recommended for inexperienced users, as any mistake made during removal could result in catastrophic damage being caused to your operating system, forcing you to re-install it. The best way for an inexperienced user to perform Wireshark Antivirus removal without hurting the computer is to use a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus.

My Security Shield Removal

virus removal man — Wed, 18 Aug 2010 07:33:08 +0000

My Security Shield is a rogue anti-malware that hails from the family of dangerous software that spawned such applications as Security Master AV, Virus Doctor and My Security Engine. Similarly to its relatives, it attempts to trick users into paying for a software license that is fake. My Security Shield gets installed on users systems thanks to Trojans that get downloaded from fake security websites which use security loopholes in the user’s system to break through. Once established on the user’s computer, My Security Shield proceeds to load at startup as a service and to perform an endless stream of fake security scans on the system. However, it must be noted that the reported ‘threats’ from these scans are completely non-existent. My Security Shield also displays fake security pop-ups from the Windows Taskbar, which causes a lot of nervousness in the hearts of users. The aim of all these warnings is to try and trick the user into paying for a software license under the claim that the currently installed ‘trial’ version of My Security Shield is incapable of properly scanning the system, and that the user should get the ‘full’ version to fix the problem. It should be kept in mind at all times that My Security Shield is a fake application and as such it cannot scan or clean your computer under any circumstances.

As soon as you find a copy of this malicious program on your system, you should take steps to immediately remove My Security Shield. For My Security Shield removal, it is necessary to stop processes, unregister DLLs, delete files and folders and remove registry entries.

File Removal Procedures

The first step you need to take in order to remove My Security Shield is to stop the following processes from execution:

MS345d_2129.exe
DBOLE.exe
kernel32.exe

Next, it is necessary to unregister the following DLL files to ensure My Security Shield removal:

mozcrt19.dll
sqlite3.dll
fan.dll
PE.dll
std.dll

The next step you need to take in order to delete My Security Shield is to delete the following files and folders:

Windows XP:

c:\Documents and Settings\All Users\Application Data\345d567\
c:\Documents and Settings\All Users\Application Data\345d567\4475.mof
c:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\345d567\MS345d_2129.exe
c:\Documents and Settings\All Users\Application Data\345d567\MSS.ico
c:\Documents and Settings\All Users\Application Data\345d567\sqlite3.dll
c:\Documents and Settings\All Users\Application Data\345d567\BackUp\
c:\Documents and Settings\All Users\Application Data\345d567\MSSSys\
c:\Documents and Settings\All Users\Application Data\345d567\MSSSys\vd952342.bd
c:\Documents and Settings\All Users\Application Data\345d567\Quarantine Item\
c:\Documents and Settings\All Users\Application Data\MSHBXRCOBWS\
c:\Documents and Settings\All Users\Application Data\MSHBXRCOBWS\MSJYQMS.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\My Security Shield.lnk
%UserProfile%\Application Data\My Security Shield\
%UserProfile%\Application Data\My Security Shield\cookies.sqlite
%UserProfile%\Application Data\My Security Shield\Instructions.ini
%UserProfile%\Desktop\My Security Shield.lnk
%UserProfile%\Recent\cid.drv
%UserProfile%\Recent\CLSV.tmp
%UserProfile%\Recent\DBOLE.exe
%UserProfile%\Recent\delfile.sys
%UserProfile%\Recent\fan.dll
%UserProfile%\Recent\grid.sys
%UserProfile%\Recent\kernel32.exe
%UserProfile%\Recent\kernel32.sys
%UserProfile%\Recent\PE.dll
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\runddlkey.drv
%UserProfile%\Recent\SICKBOY.drv
%UserProfile%\Recent\std.dll
%UserProfile%\Recent\tempdoc.tmp
%UserProfile%\Recent\tjd.sys
%UserProfile%\Start Menu\My Security Shield.lnk
%UserProfile%\Start Menu\Programs\My Security Shield.lnk

Windows Vista/Windows 7:

c:\Documents and Settings\All Users\AppData\345d567\
c:\Documents and Settings\All Users\AppData 345d567\4475.mof
c:\Documents and Settings\All Users\AppData\345d567\mozcrt19.dll
c:\Documents and Settings\All Users\AppData\345d567\MS345d_2129.exe
c:\Documents and Settings\All Users\AppData\345d567\MSS.ico
c:\Documents and Settings\All Users\AppData 345d567\sqlite3.dll
c:\Documents and Settings\All Users\AppData \345d567\BackUp\
c:\Documents and Settings\All Users\AppData\345d567\MSSSys\
c:\Documents and Settings\All Users\AppData\345d567\MSSSys\vd952342.bd
c:\Documents and Settings\All Users\AppData\345d567\Quarantine Item\
c:\Documents and Settings\All Users\AppData\MSHBXRCOBWS\
c:\Documents and Settings\All Users\AppData \MSHBXRCOBWS\MSJYQMS.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\My Security Shield.lnk
%UserProfile%\AppData\My Security Shield\
%UserProfile%\AppData\My Security Shield\cookies.sqlite
%UserProfile%\AppData\My Security Shield\Instructions.ini
%UserProfile%\Desktop\My Security Shield.lnk
%UserProfile%\Recent\cid.drv
%UserProfile%\Recent\CLSV.tmp
%UserProfile%\Recent\DBOLE.exe
%UserProfile%\Recent\delfile.sys
%UserProfile%\Recent\fan.dll
%UserProfile%\Recent\grid.sys
%UserProfile%\Recent\kernel32.exe
%UserProfile%\Recent\kernel32.sys
%UserProfile%\Recent\PE.dll
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\runddlkey.drv
%UserProfile%\Recent\SICKBOY.drv
%UserProfile%\Recent\std.dll
%UserProfile%\Recent\tempdoc.tmp
%UserProfile%\Recent\tjd.sys
%UserProfile%\Start Menu\My Security Shield.lnk
%UserProfile%\Start Menu\Programs\My Security Shield.lnk

After the above steps have been completed, My Security Shield no longer resides on your hard disk. Even if in most cases manual removal is possible, it is however advisable to rely on professional, automated antivirus solutions that can properly detect threats such as My Security Shield. For this reason, a complete system scan using genuine antivirus software such as Spyware Doctor with Antivirus is highly recommended.

Registry Removal Procedures

Removing files and folders is not enough to ensure complete My Security Shield removal. To completely remove My Security Shield, you need to delete the following keys and settings from the Windows Registry:

HKEY_CURRENT_USER\Software\3
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\MS345d_2129.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=2129&q={searchTerms}”
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=2129&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer “PRS” = “http://127.0.0.1:27777/?inj=%ORIGINAL%”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “control/7.02129″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “My Security Shield”
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=2129&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = “no”

Once the above steps have been completed, your computer is safe from My Security Shield.

Conclusion

Manual My Security Shield removal is not recommended for inexperienced users as any mistake made during removal could cause problems for the operating system of the computer. Therefore inexperienced users are advised to use a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus for safe and efficient My Security Shield removal.

Network Control Removal

virus removal man — Wed, 18 Aug 2010 07:26:55 +0000

Trojans are a type of malware that enter the user’s computer under the pretext of being a useful program only to end up making many harmful changes to the computer. Network Control is one such Trojan that gets downloaded and installed on to user systems from malicious websites which the user makes the mistake of visiting. Once installed, Network Control displays a message stating that a remote administrator named Adam1 changed some system files on Windows. Then, Network Control will proceed to warn the user falsely that the firewall has been compromised and that any malware could enter the computer. To overcome this problem, Network Control suggests that the user purchase and install such software as Advanced Net Firewall, Shield EC, Personal Network Protect, IP Blockader and Network Defender which are in fact malicious software that will not help the user in any way. Therefore instead of falling for this trick, you should immediately take steps to remove Network Control.

As soon as you find an instance of this malware on your computer, you should take steps to initiate Network Control removal. In order to delete Network Control, you need to stop its processes, unregister its DLL files, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step you need to take for Network Control removal is to stop the following processes from executing:

nc.exe
checker.exe

Next, it is necessary to unregister the following DLL file:

tmp.dll

The next step in Network Control removal is to delete the following files and folders:

C:\NetworkControl\
C:\NetworkControl\checker.exe
C:\NetworkControl\list
C:\NetworkControl\nc.exe
C:\NetworkControl\tmp.dll
C:\NetworkControl\tpm.dll
C:\WINDOWS\Fonts\segoeui.ttf
%UserProfile%\Local Settings\Temp\abc
%UserProfile%\Local Settings\Temp\i.bat

After these steps have been completed Network Control no longer resides on your hard disk. While in most cases following the manual removal procedures is sufficient, due to the prevalent nature of Network Control malicious software it is recommended to scan the entire computer using genuine antivirus software such as Spyware Doctor with Antivirus. In this way, not only that other hidden or yet unknown Network Control malicious components can be discovered but also other infections, if any, may be revealed and dealt with.

Registry Removal Procedures

The deletion of files and folders alone is not sufficient to completely remove Network Control. You need to remove the following keys and settings from the Windows Registry for complete Network Control removal:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = “0″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnPostRedirect” = “0″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “NetworkControl”

Now your computer is safe from Network Control.

Conclusion

Manual Network Control removal is not recommended for inexperienced users as any mistake made during removal could cause damage to the operating system of the computer. Therefore, it is important that inexperienced users get the help of a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus for complete Network Control removal.

Windows Protection Suite Removal

virus removal man — Wed, 18 Aug 2010 07:20:17 +0000

Windows Protection Suite is a dangerous fake anti-malware application that appears as a legitimate malware removal tool in an attempt to swindle users of their money. The method used to steal the user’s money is that of scaring them using security warnings and threat reports that are completely false. Windows Protection Suite reaches users systems via Trojans that get downloaded from malicious websites. Once installed, Windows Protection Suite loads up as a startup application and launches into a series of fake malware scans, generating endless reports of a large amount of malicious activity being detected on the user’s system. Fake pop-ups are also generated from the Windows Taskbar, warning of malware that does not exist. The aim of all these fake warnings is to scare the user into purchasing a license for the ‘full’ version of Windows Protection Suite by claiming that the currently installed ‘trial’ version cannot fully clean the detected ‘threats’. However, the so-called ‘full’ version is just as incapable of scanning or cleaning the user’s system as the ‘trial’ version is.

Once you detect the malicious activity described above, it suggests an infection of Windows Protection Suite. You should take immediate measures to remove this rogue program. In order to initiate Windows Protection Suite removal, you need to stop its processes, unregister its DLL files, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step you need to take in Windows Protection Suite removal is to stop the following processes:

WI345d.exe
CLSV.exe
snl2w.exe
std.exe
WindowsProtectionSuite.exe
WI345d.exe
ppal.exe

Next, it is necessary to unregister the following DLL files:

tempdoc.dll
energy.dll
mozcrt19.dll
sqlite3.dll
cid.dll
CLSV.dll
ddv.dll

The next step in Windows Protection Suite removal is to delete the following files and folders:

WI345d.exe
CLSV.exe
snl2w.exe
std.exe
WindowsProtectionSuite.exe
WI345d.exe
ppal.exe
tempdoc.dll
energy.dll
mozcrt19.dll
sqlite3.dll
cid.dll
CLSV.dll
ddv.dll
tempdoc.dll
WINPS.ico
working.log
vd952342.bd
winps.cfg
cookies.sqlite
Instructions.ini
cb.sys
cid.tmp
CLSV.tmp
DBOLE.sys

After these steps have been completed, your computer’s hard disk no longer contains Windows Protection Suite. In order to make sure that all the above malicious components have been properly removed it is recommended to scan the entire system using genuine antivirus software such as Spyware Doctor with Antivirus.

Registry Removal Procedures

Removal of files and folders alone is not sufficient to completely delete Windows Protection Suite. The following registry keys and settings should also be deleted for complete Windows Protection Suite removal:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WindowsProtectionSuite”
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WI345d.DocHostUIHandler
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://search-gala.com/?&uid=7&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “9877034603″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows Protection Suite”

Now it is safe to say that your computer is completely devoid of anything to do with Windows Protection Suite.

Conclusion

Manual Windows Protection Suite removal is not recommended for inexperienced users as one wrong move during the process could cause irreversible damage to your operating system. Therefore the best course of action to take would be to use a web-based repair service such as www.onlinecomputerrepair.org or a legitimate antivirus program such as Spyware Doctor with Antivirus to ensure that Windows Protection Suite removal is done in a safe and efficient manner.

Antivirus 2010 Security Centre Removal

virus removal man — Wed, 18 Aug 2010 07:13:51 +0000

One of the more dangerous rogue anti-malware programs circulating through the World Wide Web today, Antivirus 2010 Security Centre is a notorious program that attempts to dupe users in to purchasing a software license. This rogue program installs itself on user systems with the help of Trojans that get downloaded through security loopholes in the computer. Once installed, Antivirus 2010 Security Centre proceeds to load up whenever Windows boots and to perform numerous fake malware scans on the computer, reporting heavy amounts of malware activity on the computer which isn’t true. Fake pop-ups generated from the Windows Taskbar add to the user’s worries. The aim of all this activity is to try and get the user to pay for the ‘full’ version of Antivirus 2010 Security Centre by convincing them that the currently installed ‘trial’ version is insufficient to remove the detected ‘threats’. However, you should always remember that the detected fake ‘threats’ don’t really, exist, and that Antivirus 2010 Security Centre could never remove any real threats to your computer.

If you should ever find an instance of this dangerous malware application on your computer, you should immediately initiate Antivirus 2010 Security Centre removal. In order to remove Antivirus 2010 Security Centre, you need to stop its processes, unregister its DLLs, delete its files and folders and remove its registry entries.

File Removal Procedures

The first the step you need to take for Antivirus 2010 Security Centre removal is to stop the following process from executing:

[random characters].exe

The next step you need to take in Antivirus 2010 Security Centre removal is to unregister the following DLL file:

[random characters].dll

Next, it is necessary to delete the following files and folders from your hard disk in order to delete Antivirus 2010 Security Centre:

Windows XP:

%Documents and Settings%\All Users\Start Menu\Programs\Antivirus 2010 Security Centre
%Documents and Settings%\All Users\Desktop\Antivirus 2010 Security Centre.lnk
%Documents and Settings%\All Users\Application Data\Antivirus 2010 Security Centre
c:\Documents and Settings\All Users\Application Data
c:\WINDOWS\system32\[random characters].dll
c:\WINDOWS\system32\[random characters].exe
c:\Documents and Settings\All Users\Application Data\.wtav
c:\WINDOWS\system32\mswmqnei.dll
c:\WINDOWS\system32\us?rinit.exe

Windows Vista/Windows 7:

%Documents and Settings%\All Users\Start Menu\Programs\Antivirus 2010 Security Centre
%Documents and Settings%\All Users\Desktop\Antivirus 2010 Security Centre.lnk
%Documents and Settings%\All Users\AppData\Antivirus 2010 Security Centre
%Documents and Settings%All Users\AppData
c:\WINDOWS\system32\[random characters].dll
c:\WINDOWS\system32\[random characters].exe
%Documents and Settings%All Users\AppData.wtav
c:\WINDOWS\system32\mswmqnei.dll
c:\WINDOWS\system32\us?rinit.exe

Once the above steps have been completed, no instances of Antivirus 2010 Security Centre reside on your hard disk any longer. However, due to the prevalent nature of this rogue software it is recommended to scan the entire computer using professional antivirus products such as Spyware Doctor with Antivirus in an attempt to identify any remaining malicious components.

Registry Removal Procedures

Although you may have deleted all the files and folders, this does not ensure complete Antivirus 2010 Security Center removal. In order to completely remove Antivirus 2010 Security Centre, you need to remove the following keys and settings from the Windows Registry:

HKEY_CURRENT_USER\Software\Antivirus 2010 Security Centre
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus 2010 Security Centre
HKEY_CLASSES_ROOT\Interface\[random characters]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[random characters]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\userinit
HKEY_CLASSES_ROOT\Interface\[35c95ec8-f789-9a3a-375c-bdb89a3684fd]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[9CB00F85-D96F-1C82-F5A4-A31D57D6528D]

Now it is safe to say that you have managed to completely remove Antivirus 2010 Security Centre from your computer.

Conclusion

Manual Antivirus 2010 Security Centre removal is not recommended for inexperienced users as any mistake made during removal could cause heavy damage to the computer’s operating system. Inexperienced users are therefore advised to use a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus for safe Antivirus 2010 Security Centre removal.

Virus Total 2010 Removal

virus removal man — Wed, 18 Aug 2010 07:07:22 +0000

One of the most annoying and dangerous rogue anti-malware applications out there as well as being related to Smart Security AV, Virus Total 2010 will attempt to scare innocent users into purchasing a fake software license. This rogue software application gets installed on user systems via Trojans that infiltrate the computer using security loopholes. Once installed, Virus Total 2010 will perform a large number of fake scans on the computer and insist that it is filled with a myriad of viruses. It will also display fake pop-ups from the Windows taskbar warning about viruses that don’t really exist. It will also redirect the web browser to a malicious website that promotes Virus Total 2010 whenever the user tries to surf the internet. The aim of all this activity is to trick the user into purchasing the ‘full’ version of Virus Total 2010 through the claim that the currently installed ‘trial’ version is not capable of properly removing the detected viruses. It is important to keep in mind that Virus Total 2010 is a fake application that cannot scan or clean your computer properly no matter what its version.

As soon as you detect a copy of this malicious application on your computer, you should initiate Virus Total 2010 removal. In order to delete Virus Total 2010, you need to stop its processes, unregister its DLL files, remove its files and folders, and delete its registry entries.

File Removal Procedures

The best way to attempt to manually remove Virus Total 2010 is to use the Add/Remove Programs feature included in Windows. Through this tool, simply choose Virus Total 2010; this will remove all its related files and folders as well as DLLs. However, even if it is possible to conduct Virus Total 2010 removal using it’s uninstall component, it is recommended to scan the entire system using a genuine antivirus product such as Spyware Doctor with Antivirus. By doing so, any other auxiliary malicious components that have not yet been removed or identified will be properly taken care of in an automatic way.

Registry Removal Procedures

File deletion alone is not sufficient to completely remove Virus Total 2010 from your computer. In order to ensure complete Virus Total 2010 removal, it is necessary to delete the following keys and settings from the Windows Registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Virus Total 2010″

Now it is safe to say that you have completed Virus Total 2010 removal. However, in order to make sure of this fact, it is recommended to scan the entire computer using genuine antivirus software such as Spyware Doctor with Antivirus.

Conclusion

Manual Virus Total 2010 removal is not recommended for novice users as any mistake on your part could cause damage to the operating system. Therefore the best way to go if you are inexperienced is to use a web-based virus scanning and cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus for Virus Total 2010 removal.

Earth AV Removal

virus removal man — Mon, 09 Aug 2010 10:55:55 +0000

Related to the notorious rogue anti-malware Green AV, Earth AV is a rogue program that attempts to rip off users under the pretext of selling them the full version of a piece of software. Earth AV reaches user systems via Trojans that get downloaded from websites that claim to contain Flash player downloads. Once the Trojan is downloaded and installed on the computer, it downloads and installs Earth AV by exploiting security vulnerabilities in the system. Once installed, Earth AV proceeds to perform fake antivirus scans on the system through which it creates false results and warnings about viruses that don’t exist on the computer. It also creates a large number of fake warning pop-ups from the Windows Taskbar which are totally irrelevant. This is to try and induce the user to purchase the license to the ‘full’ version of Earth AV, by making them feel that the currently installed ‘trial’ version is incapable of saving the system from sure destruction. However, do not make any hasty decisions as Earth AV is a fake application that should not be trusted under any circumstances.

The first thing you should do as soon as you find a copy of this malware on your computer is initiate Earth AV removal. In order to delete Earth AV, it is important to stop processes, unregister DLLs, delete files and folders and remove registry entries.

File Removal Procedures

The first step you need to take in order to remove Earth AV is to stop the following processes:

ergui.exe
ErV_paid.exe
eav.exe
msdl.exe
vec.exe

Next, it is necessary to unregister the following DLL files:

ergui.exe
ErV_paid.exe
eav.exe
msdl.exe
vec.exe

The next step in Earth AV removal is to delete the following files and folders:

Windows XP:

%Documents and Settings%\All Users\Start Menu\Programs\Earth AV
%Documents and Settings%\All Users\Desktop\Earth AV.lnk
%Documents and Settings%\All Users\Application Data\Earth AV
c:\Documents and Settings\All Users\Application Data\eav
c:\Documents and Settings\All Users\Application Data\eav\Base.dat
c:\Documents and Settings\All Users\Application Data\eav\msdl.exe
c:\Documents and Settings\All Users\Application Data\eav\msll.exe
c:\Documents and Settings\All Users\Application Data\eav\vec.exe
c:\Documents and Settings\All Users\Application Data\Microsoft\Machine
c:\Documents and Settings\All Users\Application Data\Microsoft\Machine\WStech.dll
c:\Documents and Settings\All Users\Start Menu\Programs\ Earth AV
c:\Documents and Settings\All Users\Desktop\ Earth AV .lnk
%APPDATA%\mozilla\firefox\profiles\\gsl.dll
ergui.exe
ErV_paid.exe

Windows Vista/Windows 7:

%Documents and Settings%\All Users\Start Menu\Programs\Earth AV
%Documents and Settings%\All Users\Desktop\Earth AV.lnk
%Documents and Settings%\All Users\Application Data\Earth AV
%USER%\AppData\eav
%USER%\AppData\eav\Base.dat
%USER%\AppData\eav\msdl.exe
%USER%\AppData\msll.exe
%USER%\AppData\av\vec.exe
%USER%\AppData\Microsoft\Machine
%USER%\AppData\Microsoft\Machine\WStech.dll
%USER%\AppData\Start Menu\Programs\ Earth AV
c:\Documents and Settings\All Users\Desktop\ Earth AV .lnk
%APPDATA%\mozilla\firefox\profiles\\gsl.dll
ergui.exe
ErV_paid.exe

After the above steps have been completed, Earth AV no longer resides on your hard disk. Even if this is true in most cases, due to the complex nature of this threat it is still recommended to run a full system scan of the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus.

Registry Removal Procedures

File deletion alone is not sufficient to completely remove Earth AV. The following registry entries should be deleted as well in order to ensure complete Earth AV removal:

HKEY_CURRENT_USER\Software\Earth AV
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run “Earth AV”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Earth AV
HKEY_CURRENT_USER\Software\EAV
HKEY_CLASSES_ROOT\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774}
HKEY_CLASSES_ROOT\AppID\WStech.DLL
HKEY_CLASSES_ROOT\CLSID\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKEY_CLASSES_ROOT\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}
HKEY_CLASSES_ROOT\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
HKEY_CLASSES_ROOT\WStech.WStechB
HKEY_CLASSES_ROOT\WStech.WStechB.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}\S
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “mxcll”

Conclusion

Manual Earth AV removal is not recommended for novice users, as any mistake made during removal could result in damage being caused to the operating system of the computer. Therefore, inexperienced computer users are asked to make use of a web-based repair software such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus.

Earth Antivirus Removal

virus removal man — Mon, 09 Aug 2010 10:50:34 +0000

Related to Green AV and Eco Antivirus, Earth Antivirus is a rogue antivirus program that uses scare tactics to push users into purchasing a fake software license. Earth Antivirus installs itself on the system using Trojans that get downloaded from fake online scanner websites and malicious websites. Once installed, the rogue software launches itself as a service and performs an endless stream of fake virus scans, consequently tagging a lot of non-existent viruses as those affecting the system. Alongside other low performance PC related symptoms, a steady stream of fake warning pop-ups are also displayed from the Windows Taskbar. Finally, Earth Antivirus redirects the user to the payment page of the so-called ‘full’ version of Earth Antivirus, under the pretext that the currently installed ‘trial’ version is not sufficient to remove the detected ‘threats’. However, it should be kept in mind that Earth Antivirus is a fake program that cannot remove any type of malware from your computer.

As soon as you find a copy of Earth Antivirus on your system, you should initiate Earth Antivirus removal. In order to delete Earth Antivirus, you need to stop its running processes, unregister its DLL files, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step you need to take for Earth Antivirus removal is to stop the following processes:

ergui.exe
ErV_paid.exe
eav.exe
msdl.exe
vec.exe

Next, it is necessary to unregister the following DLL files:

gsl.dll
WStech.dll

The next step in Earth Antivirus removal is to delete the following files and folders:

Windows XP:

%Documents and Settings%\All Users\Start Menu\Programs\Earth AV
%Documents and Settings%\All Users\Desktop\Earth AV.lnk
%Documents and Settings%\All Users\Application Data\Earth AV
c:\Documents and Settings\All Users\Application Data\eav
c:\Documents and Settings\All Users\Application Data\eav\Base.dat
c:\Documents and Settings\All Users\Application Data\eav\msdl.exe
c:\Documents and Settings\All Users\Application Data\eav\msll.exe
c:\Documents and Settings\All Users\Application Data\eav\vec.exe
c:\Documents and Settings\All Users\Application Data\Microsoft\Machine
c:\Documents and Settings\All Users\Application Data\Microsoft\Machine\WStech.dll
c:\Documents and Settings\All Users\Start Menu\Programs\ Earth AV
c:\Documents and Settings\All Users\Desktop\ Earth AV .lnk
%APPDATA%\mozilla\firefox\profiles\\gsl.dll
ergui.exe
ErV_paid.exe

Windows Vista/7:

%Documents and Settings%\All Users\Start Menu\Programs\Earth AV
%Documents and Settings%\All Users\Desktop\Earth AV.lnk
%Documents and Settings%\All Users\Application Data\Earth AV
%USER%\AppData\eav
%USER%\AppData \eav\Base.dat
%USER%\AppData \eav\msdl.exe
%USER%\AppData \eav\msll.exe
%USER%\AppData \eav\vec.exe
%USER%\AppData \Microsoft\Machine
%USER%\AppData \Microsoft\Machine\WStech.dll
%USER%\Documents\Start Menu\Programs\ Earth AV
%USER% \Desktop\ Earth AV .lnk
%APPDATA%\mozilla\firefox\profiles\\gsl.dll
ergui.exe
ErV_paid.exe

After the above steps have been completed, Earth Antivirus no longer exists on your hard disk. In order to make sure of this fact it is recommended to scan the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus.

Registry Removal Procedures

File removal alone is not sufficient to completely delete Earth Antivirus. The following keys and settings need to be deleted from the Windows Registry in order to ensure complete Earth Antivirus Removal:

HKEY_CURRENT_USER\Software\Earth AV
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run “Earth AV”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Earth AV
HKEY_CURRENT_USER\Software\EAV
HKEY_CLASSES_ROOT\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774}
HKEY_CLASSES_ROOT\AppID\WStech.DLL
HKEY_CLASSES_ROOT\CLSID\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKEY_CLASSES_ROOT\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}
HKEY_CLASSES_ROOT\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
HKEY_CLASSES_ROOT\WStech.WStechB
HKEY_CLASSES_ROOT\WStech.WStechB.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}\S
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “mxcll”

Now it is safe to say that Earth Antivirus has been completely removed from your computer.

Conclusion

Manual Earth Antivirus removal is not recommended for inexperienced users, as any mistake made during removal could cause serious damage to the operating system of the computer. Therefore, inexperienced users are advised to make use of a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus to ensure safe Earth Antivirus removal.

Antispyware Defender Removal

virus removal man — Mon, 09 Aug 2010 10:42:54 +0000

There are many malware applications out there that will try and rip you off for your money without giving you any service in return. Antispyware Defender is such a program, as it attempts to scare users into paying for a software license by trying to convince them that their computers are infected with dangerous malware. Antispyware Defender installs itself on user systems with the aid of Trojans that get downloaded from malicious websites which promote fake scanner software.

Once downloaded, these Trojans will go ahead and download and install Antispyware Defender without the knowledge of the user. After it has installed itself, Antispyware Defender will proceed to load up as a Windows startup service. Trying to show itself off as a legitimate service, Antispyware Defender will perform an endless number of scans on the computer’s hard drive, coming up with results that falsely state that the system is dangerously infected with a bunch of malware applications that cannot be removed. It will also display fake notifications from the Windows Taskbar stating that the computer is infected with malware.

At the end of all this, Antispyware Defender will ask the user to go to its website and purchase the software license for the ‘full’ version of the application, claiming that the currently installed ‘Trial’ version cannot properly remove the detected ‘threats’ to the system. It is important to note that Antispyware Defender is a fake program that should not be trusted under any circumstances, and if you do fall for this trap, immediately contact your credit card vendor and annul the payment you made for Antispyware Defender.

Once you find an instance of Antispyware Defender on your computer, you should immediately initiate Antispyware Defender removal. In order to delete Antispyware Defender, you need to remove its registry entries.

Registry Removal Procedures

In order to remove Antispyware Defender, it is necessary to remove the following keys and settings from the Windows Registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Antispyware Defender”

Once the above registry entry has been removed, your computer is safe from Antispyware Defender.

Conclusion

Manual Antispyware Defender removal is not recommended for inexperienced users as any mistake made during removal could cause damage to the computer. Therefore, inexperienced users are advised to use a web-based scanning/ repair service or legitimate antivirus software for Antispyware Defender removal.

AV Clean Removal

virus removal man — Wed, 28 Jul 2010 06:53:12 +0000

One of the more notorious rogue anti-malware programs to plague computer users recently, AV Clean uses scare tactics to push users into the purchase of a bogus software license. AV Clean, which also passes under the name of AV-Clean, gets installed on user systems via Trojans that get downloaded from malicious websites. Once installed, AV Clean establishes itself as a startup service. It then proceeds to fabricate a large amount of fake virus scans at the end of which it claims that the computer is infected with myriad of viruses that aren’t really there.

AV Clean is also known to display fake pop-ups from the Windows taskbar as well as to install a Browser Helper Object which redirects the user’s web browser whenever he or she attempts to surf the internet. The aim of all this activity is to try and get the user to pay for the so-called ‘full’ version of AV-Clean by making them believe that the currently installed ‘trial’ version is incapable of cleaning out the detected ‘threats’ to the system. However, it should be kept in mind that no version of AV Clean can scan or properly clean any system.

As soon as you discover that your system is infected with AV Clean, you should initiate AV-Clean removal. In order to delete AV Clean, it is necessary to stop its processes, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step in AV-Clean removal is to stop the following processes from executing:

avreg.exe
avclean.exe

The next step in AV-Clean removal is the deletion of the following files and folders from your hard disk:

%ProgramFiles%\avclean\etc\avreg.exe
%ProgramFiles%\avclean\etc\avfilterdriver.sys
c:\DelUS.bat
%Temp%\AV CLEAN
%Programs%\AVClean
%Temp%\AV CLEAN\list_control
%Temp%\nsu2.tmp
%ProgramFiles%\AVClean
%ProgramFiles%\AVClean\db
%ProgramFiles%\AVClean\etc
%ProgramFiles%\AVClean\etc\temp
%ProgramFiles%\AVClean\Lang
%ProgramFiles%\AVClean\skin
%ProgramFiles%\AVClean\temp

After the above steps have been completed, AV Clean no longer resides on your hard disk.

Registry Removal Procedures

Removing files alone is not sufficient to get rid of AV Clean completely. To ensure complete AV-Clean removal, you must remove the following keys and settings from the Windows Registry as well:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] AVClean = “”%ProgramFiles%\AVClean\AVClean.exe” /Scan”
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVClean] “AVClean”
[HKEY_LOCAL_MACHINE\SOFTWARE\Ebiz\AV CLEAN] “%ProgramFiles%\AVClean”
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVFMON\0000\Control] “AVFMON”
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVFMON\Security] “\??\%ProgramFiles%\avclean\etc\AVFilterDriver.SYS”

Now it is safe to say that AV Clean no longer exists on your computer. In order to certify this fact it is best advised to scan the entire computer with a genuine antivirus product such as Spyware Doctor with Antivirus. By doing so as part of the AV Clean removal process you will make sure that no additional malicious components reside on your PC.

Conclusion

Manual AV Clean removal is not safe in the case of inexperienced users, as any mistake made during removal could cause some serious damage to the operating system. Therefore inexperienced users are advised to make use of a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus when attempting to engage in AV-Clean removal.